Brand Impersonation: How to Spot and Take Down a Fake Website

On a Monday morning, the office manager at a renovation contractor in Mississauga takes an odd call. A client wants to know why an invoice she "paid online" last week still shows as overdue. The payment link came in an email with the company's logo and invoice template, sent from a domain that was almost identical: one letter doubled.

Nobody hacked the company. The fraudster registered a look-alike domain for a few dollars, copied the branding, and emailed clients found through the company's Facebook page. The scenario is fictional, but the technique is routine.

Brand impersonation doesn't require breaking into your systems, which is exactly why it's hard to prevent. The good news: there are clear routes to get a fake site taken down, and simple steps that make the fraudster's job harder.

The many faces of brand impersonation

Take a fictional business whose domain is yourcompany.ca. Here are the variations a fraudster can exploit:

That last row is often overlooked. A fake Facebook page running a giveaway, or a bogus job posting on LinkedIn, trades on the same trust as your website.

Why small businesses get targeted

Fraudsters don't only go after big brands. A small business offers three advantages: customers who know and trust it, recurring invoices and payments that are easy to imitate, and rarely anyone watching for new domain registrations.

Typical uses include redirecting invoice payments, harvesting customer credentials on a fake login page, selling counterfeit goods through a cloned store, or collecting personal information with a fake job offer. Look-alike domains are also a springboard for vendor banking change fraud, where the fraudster poses as you to your own customers.

Catch the fake site before your customers do

You can't stop someone from registering a domain. You can see it appear early.

Monitor variations of your name. Brand monitoring services and open-source tools (dnstwist, for example) generate plausible variations of your domain and check which ones are registered.

Search certificate transparency logs. Every public TLS certificate is recorded in open logs you can search through sites like crt.sh. Fake sites almost always show the padlock, so searching those logs for your name often reveals a fake site before it goes live.

Read your DMARC reports. Aggregate reports show which servers send email using your domain. If you don't have a DMARC policy yet, our explainer on SPF, DKIM and DMARC walks through the setup, and our DMARC, SPF and DKIM checker shows where you stand in seconds.

Make reporting easy. Your customers and staff often spot fraud first. A clear address for reporting suspicious emails, listed on your website and invoices, is worth more than most tools.

Getting a fake site taken down: step by step

The instinct is to demand an immediate shutdown. In practice, you work on several fronts at once.

1. Document without interacting. Screenshots, the full URL, date and time, the full headers of the email received. Never enter information on the fake site.
2. Identify the registrar and host. A WHOIS or RDAP lookup tool, such as ICANN's (lookup.icann.org), shows the domain's registrar and its abuse contact.
3. Report to the registrar and host. Registrars under contract with ICANN must maintain an abuse contact and take reasonable and prompt steps to investigate reports. Attach your evidence and explain how the site impersonates your business.
4. Get browsers to block it. Google Safe Browsing's reporting form and Microsoft's unsafe site report can trigger warnings for visitors, often before the site itself comes down.
5. For a .ca, alert CIRA. The Canadian Internet Registration Authority has a form for reporting domain abuse such as phishing or malware distribution, and can launch a verification of the registrant's information.
6. Report the fraud. File with the Canadian Anti-Fraud Centre, and with your local police if customers lost money.
7. Warn your customers. Post a notice on your website and social media and send an email, without ever including a clickable link to the fake site.

For a fake social media page, use the platform's impersonation reporting (on LinkedIn, for example, the page's "More" menu, then "Report abuse").

Legal remedies: CDRP and UDRP

Abuse reports aim to stop the fraud. Dispute resolution proceedings aim to recover or cancel the domain.

For a .ca, CIRA's Domain Name Dispute Resolution Policy (CDRP) offers an out-of-court route to have a bad-faith registration transferred or cancelled. The complainant generally has to meet CIRA's Canadian Presence Requirements, show the domain is confusingly similar to a mark in which it had rights before the registration, show bad faith, and provide some evidence that the registrant has no legitimate interest.

For .com, .net and most other generic extensions, the route is the UDRP, administered by providers including WIPO.

A trademark registered with the Canadian Intellectual Property Office (CIPO) makes these proceedings easier. They require rigour, so talk to your lawyer or trademark agent before filing.

Make impersonation harder

• DMARC policy at p=reject on your main domain, and on domains that never send email
• The most obvious variations registered: .ca, .com, with and without hyphens
• Registrar account protected with MFA, and transfer lock enabled on your domains
• An "Our official channels" page on your website stating that you never change banking details by email
• Your name claimed on the major social platforms, even the ones you don't use
• One person responsible for reports, and a written takedown procedure
• Monthly monitoring of new domains and certificates using your name

The bottom line

Brand impersonation is a risk you can't eliminate, but you can shorten it. The sooner you spot a look-alike domain, the fewer victims it claims. With a procedure ready, a takedown becomes routine instead of a scramble.

Monitoring domains, certificates and DMARC reports is part of our ongoing security partner service: we spot imitations, prepare the reports and help you warn your customers.